A big factor for me is that this feature would be 100% for self hosters, I don’t really want to carry a safe mode for plugins in core, it is certainly not something we would use, coordinating a restart across 5 clusters is hard
Docker manager is the right vehicle here, it already supports restarting the app, something that you need for your proposal to work and it can do all of the stuff it needs without changes to discourse core